# Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365 · pwn.watch > On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940). Page: https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142 · generated 2026-10-27T18:18:44.616Z ## Status - Severity: critical · status: live · patch: patched - Product: Veeam Backup & Replication 13, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE - Started: 2026-10-27 - CVEs: CVE-2026-108142, CVE-2026-108140, CVE-2026-108141, CVE-2026-105477, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2025-64394, CVE-2026-107671 - Affected: Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds; Veeam Backup & Replication 13.0.2.29 and earlier 13.0 builds (12.x not affected); Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds, when managed by Backup & Replication; Veeam Backup for Microsoft 365 8.6.0.1102 and earlier version 8 builds (8.5.0.1014 and earlier for CVE-2026-106076 and CVE-2026-106077); Veeam ONE 13.1.0.7233 and earlier 13.1 builds - Fixed in: Veeam Backup & Replication 13.1.2 (build 13.1.2.57); Veeam Backup & Replication 13.0.3 (build 13.0.3.63); Veeam Agent for Linux 13.1.2 (build 13.1.2.11); Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011); Veeam ONE 13.1 P1 (build 13.1.0.7940) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/feed.xml - JSON Feed: https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142.json - This file: https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/llms.txt ## Updates (newest first) - 2026-10-27: Veeam publishes KB4948: Backup & Replication 13.1.2 and 13.0.3 fix the critical unauthenticated CDP Coordinator authorization bypass CVE-2026-108142, two NAS restore path traversal bugs, and an Agent for Linux privilege escalation. (https://www.veeam.com/kb4948) - 2026-10-27: Veeam publishes KB4957: Backup for Microsoft 365 8.6 and 8.6 Patch 1 fix a critical cross-tenant SQL injection with code execution (CVE-2026-106076), an arbitrary file read, a REST API authentication bypass and an installer file-write bug. (https://www.veeam.com/kb4957) - 2026-10-27: Veeam publishes KB4951: Veeam ONE 13.1 P1 fixes an MFA bypass for attackers with Administrator credentials (CVE-2026-107671). (https://www.veeam.com/kb4951) ## Fix brief # Security brief: Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365 Source: https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142 · status: live · severity: critical · updated Oct 27, 2026, 17:26 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940). Severity detail: CVSS 4.0 9.1 for the unauthenticated CDP Coordinator authorization bypass (CVE-2026-108142) and 9.0 for the Backup for Microsoft 365 SQL injection (CVE-2026-106076, needs an authenticated organization-transfer peer); Veeam's bulletins do not mention exploitation - Product: Veeam Backup & Replication 13, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE - CVE / advisory ids: CVE-2026-108142, CVE-2026-108140, CVE-2026-108141, CVE-2026-105477, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2025-64394, CVE-2026-107671 ## Affected versions - Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds - Veeam Backup & Replication 13.0.2.29 and earlier 13.0 builds (12.x not affected) - Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds, when managed by Backup & Replication - Veeam Backup for Microsoft 365 8.6.0.1102 and earlier version 8 builds (8.5.0.1014 and earlier for CVE-2026-106076 and CVE-2026-106077) - Veeam ONE 13.1.0.7233 and earlier 13.1 builds ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Veeam Backup & Replication 13.1.2 (build 13.1.2.57) - Veeam Backup & Replication 13.0.3 (build 13.0.3.63) - Veeam Agent for Linux 13.1.2 (build 13.1.2.11) - Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) - Veeam ONE 13.1 P1 (build 13.1.0.7940) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 27, 2026: Veeam publishes KB4948: Backup & Replication 13.1.2 and 13.0.3 fix the critical unauthenticated CDP Coordinator authorization bypass CVE-2026-108142, two NAS restore path traversal bugs, and an Agent for Linux privilege escalation. - Oct 27, 2026: Veeam publishes KB4957: Backup for Microsoft 365 8.6 and 8.6 Patch 1 fix a critical cross-tenant SQL injection with code execution (CVE-2026-106076), an arbitrary file read, a REST API authentication bypass and an installer file-write bug. - Oct 27, 2026: Veeam publishes KB4951: Veeam ONE 13.1 P1 fixes an MFA bypass for attackers with Administrator credentials (CVE-2026-107671). ## Advisories - [KB4948: Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2](https://www.veeam.com/kb4948) (Veeam) - [KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6](https://www.veeam.com/kb4957) (Veeam) - [KB4951: Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1](https://www.veeam.com/kb4951) (Veeam) --- Machine-readable: https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.